Currently, credential theft is a substantial danger in the online world, for example, through “phishing”, key loggers, spyware, and man-in-the middle attacks, among others. There is presently a push from both regulators and financial institutions, such as banks, to come up with two-factor authentication techniques by which the threat of a simple credential theft, such as theft of a password, is mitigated, for example, by the fact that there is some factor other than a simple password involved in authentication. A number of forms of two-factor identification have been proposed which utilize something else besides a standard password, such as a user's fingerprint, or in a physical world, a user's ATM card.
Another example of the use of something else besides a standard password is what are referred to as one-time passwords, and specifically one-time password tokens or key fobs. These one-time password tokens represent a type of standard but very expensive way to provide a customer with a device that continuously generates a time-based, or event based, one-time password. Thus, when a user prepares to log in, the user consults the device, and the device displays, for example, a number that the user keys in and which can be used only once. Thus, if an unauthorized person intercepts the particular number, it is too late for the unauthorized person to use it.
However, those types of solutions are extremely expensive and are not necessarily user friendly. For example, customers are typically required to carry their tokens around with them, and if a customer has relationships, for example, with three or four banks, the customer is required to carry around three or four different tokens. In addition, the tokens have a limited useful life after which they must be replaced. Further, the task of distributing the tokens to users creates issues of security and expense for financial institutions, and security and convenience issues are likewise created on the customer's side in keeping up with their multiple tokens.
A particularly troublesome aspect of credential theft is electronic fraud in which increasing numbers of unsuspecting customers of financial institutions, such as banks, are phished by being sent emails attempting to trick them into revealing their user names and passwords or PINs to an unauthorized party. Typically, an unauthorized party who succeeds in capturing the log-in credentials of a bank customer through email phishing or perhaps via software viruses, reuses the customer's credentials to log on to the bank's online banking website to perform fraudulent transactions. One such type of fraudulent transaction involves use of the customer's stolen log-in credentials to move money internationally by wire transfer, and another type of fraud is a transaction referred to as a global intercity transaction that involves moving money, for example, from a bank account in the United States to a foreign bank account and withdrawing the money.